CN112733995A

CN112733995A - Method for training neural network, behavior detection method and behavior detection device

Info

Publication number: CN112733995A
Application number: CN202110016879.9A
Authority: CN
Inventors: 邓美林; 杨洋; 冯城城; 傅媛媛
Original assignee: Industrial and Commercial Bank of China Ltd ICBC
Current assignee: Industrial and Commercial Bank of China Ltd ICBC
Priority date: 2021-01-07
Filing date: 2021-01-07
Publication date: 2021-04-30

Abstract

The present disclosure provides a method for training a neural network, a behavior detection method, and a behavior detection device, which can be used in the field of artificial intelligence or other fields, wherein the neural network includes: the input layer is used for transmitting the resource transfer training data to the hidden layer; the hidden layer is used for mapping the resource transfer training data from the low-dimensional space to at least one specified dimension of the high-dimensional space to obtain an output result aiming at the at least one specified dimension; the output layer is used for outputting an output result aiming at least one specified dimension so as to determine a user resource transfer behavior portrait and a resource transfer abnormity detection model based on the output result aiming at the at least one specified dimension; the method comprises the following steps: processing the resource transfer training data by using a neural network; and at least adjusting the network parameter value of the hidden layer based on a gradient descent method, so that the clustering center of the neural network approaches to the clustering center obtained by a clustering algorithm, and a first network parameter value is obtained.

Description

Method for training neural network, behavior detection method and behavior detection device

Technical Field

The present disclosure relates to the field of artificial intelligence technologies, and in particular, to a method for training a neural network, a behavior detection method, and a behavior detection apparatus.

Background

With the rise of the wave of the internet plus, the application of the internet to upgrade the traditional industry to perform industrial enabling and intelligent upgrading is a great trend, and more traditional commercial transactions such as bank finance, e-commerce logistics and the like are transferred to the online. At the same time, the convenient payment transaction technology also brings the risk of transaction fraud and fund theft. Therefore, abnormal transactions need to be detected and identified, the risk of fund theft of the user is reduced, and the transaction safety of the user and the institution is guaranteed.

In the process of realizing the disclosed concept, the applicant finds that at least the following problems exist in the related technology, and the existing abnormal transaction detection method is not easy to calculate the personalized customized transaction threshold value of each user, so that the accuracy rate of abnormal transaction detection cannot meet the requirements of the user.

Disclosure of Invention

In view of this, the present disclosure provides a method for training a neural network, a behavior detection method, and a behavior detection device, so as to at least partially solve the problem that the accuracy of detecting abnormal transactions cannot meet the user requirements because it is not easy to calculate personalized customized transaction thresholds of users in the prior art.

One aspect of the present disclosure provides a method of training a neural network, comprising: the input layer is used for transmitting the resource transfer training data to the hidden layer; the hidden layer is used for mapping the resource transfer training data from the low-dimensional space to at least one specified dimension of the high-dimensional space to obtain an output result aiming at the at least one specified dimension; and the output layer is used for outputting the output result aiming at the at least one specified dimension so as to determine the user resource transfer behavior portrait and the resource transfer abnormity detection model based on the output result aiming at the at least one specified dimension. The method comprises the following steps: and at least adjusting the network parameter value of the hidden layer based on a gradient descent method, so that the clustering center of the neural network approaches to the clustering center obtained by a clustering algorithm to obtain a first network parameter value, wherein the behavior type comprises a normal behavior type and an abnormal behavior type.

One aspect of the present disclosure provides an abnormal behavior detection method, including: acquiring a resource transfer request, wherein the resource transfer request comprises resource transfer data; processing the resource transfer data by using the trained neural network to obtain a resource transfer abnormality detection model; processing resource transfer data based on the resource transfer abnormity detection model and the user resource transfer behavior portrait to obtain a behavior type of the resource transfer data, and processing a resource transfer request based on the behavior type of the resource transfer data; wherein, neural network includes: the input layer is used for transmitting the resource transfer training data to the hidden layer; the hidden layer is used for mapping the resource transfer training data from the low-dimensional space to at least one specified dimension of the high-dimensional space to obtain an output result aiming at the at least one specified dimension; the output layer is used for outputting an output result aiming at least one specified dimension so as to determine a user resource transfer behavior portrait and a resource transfer abnormity detection model based on the output result aiming at the at least one specified dimension; the neural network is trained by: and at least adjusting the network parameter value of the hidden layer based on a gradient descent method, so that the clustering center of the neural network approaches to the clustering center obtained by a clustering algorithm to obtain a first network parameter value, wherein the behavior type comprises a normal behavior type and an abnormal behavior type.

One aspect of the present disclosure provides an abnormal behavior detection apparatus including: the request acquisition module is used for acquiring a resource transfer request, and the resource transfer request comprises resource transfer data; the data processing module is used for processing the resource transfer data by utilizing the trained neural network to obtain a resource transfer abnormity detection model; the behavior type determining module is used for processing the resource transfer data based on the resource transfer abnormity detection model and the user resource transfer behavior portrait to obtain the behavior type of the resource transfer data so as to process the resource transfer request based on the behavior type; wherein, neural network includes: the input layer is used for transmitting the resource transfer training data to the hidden layer; the hidden layer is used for mapping the resource transfer training data from the low-dimensional space to at least one specified dimension of the high-dimensional space to obtain an output result aiming at the at least one specified dimension; the output layer is used for outputting an output result aiming at least one specified dimension so as to determine a user resource transfer behavior portrait and a resource transfer abnormity detection model based on the output result aiming at the at least one specified dimension; the neural network is trained by: and at least adjusting the network parameter value of the hidden layer based on a gradient descent method, so that the clustering center of the neural network approaches to the clustering center obtained by a clustering algorithm to obtain a first network parameter value, wherein the behavior type comprises a normal behavior type and an abnormal behavior type.

One aspect of the present disclosure provides an abnormal behavior detection system, including: the resource transfer data acquisition module is used for acquiring current resource transfer data, historical resource transfer data, third-party payment information and credit investigation information so as to finish resource transfer data acquisition; the resource transfer element fusion module is used for preprocessing the resource transfer data and fusing the resource transfer relevance to obtain a resource transfer data set; and the resource transfer abnormity detection module is used for training the neural network by using the resource transfer data set to obtain a user resource transfer behavior portrait and a resource transfer abnormity detection model, processing the current resource transfer data by using the trained neural network, and determining the probability that the current resource transfer data belongs to the abnormal behavior based on the processing result, the user resource transfer behavior portrait and the resource transfer abnormity detection model so as to perform resource transfer control.

One aspect of the present disclosure provides an abnormal behavior detection apparatus including: the resource transfer data acquisition device is used for acquiring current resource transfer data, historical resource transfer data, third-party payment information and credit investigation information so as to finish the resource transfer data acquisition; the resource transfer element fusion module is used for preprocessing the resource transfer data and fusing the resource transfer relevance to obtain a resource transfer data set; and the resource transfer abnormity detection is used for training the neural network by using the resource transfer data set to obtain a user resource transfer behavior portrait and a resource transfer abnormity detection model, processing the current resource transfer data by using the trained neural network, and determining the probability that the current resource transfer data belongs to the abnormal behavior based on the processing result, the user resource transfer behavior portrait and the resource transfer abnormity detection model so as to perform resource transfer control.

Another aspect of the present disclosure provides an electronic device comprising one or more processors and a storage, wherein the storage is configured to store executable instructions that, when executed by the processors, implement a neural network training method and/or an abnormal behavior detection method as above.

Another aspect of the present disclosure provides a computer-readable storage medium storing computer-executable instructions for implementing a neural network training method and/or an abnormal behavior detection method as above when executed.

Another aspect of the present disclosure provides a computer program comprising computer executable instructions for implementing a neural network training method and/or an abnormal behavior detection method as above when executed.

The method for training the neural network, the behavior detection method and the behavior detection device provided by the embodiment of the disclosure can generate resource transfer behavior portraits and resource transfer abnormality detection models of different users in a personalized manner, and the resource transfer behavior portraits and the resource transfer abnormality detection models are easy to update by self-learning. In addition, when the gradient descent method is used for training the neural network, the defect that global optimization cannot be achieved due to local convergence exists, and the training effect of the neural network is optimized through a clustering algorithm, so that a resource transfer behavior portrait and a resource transfer abnormity detection model with better performance are obtained.

According to the method for training the neural network, the behavior detection method and the behavior detection device, ant colony clustering is completed by adopting a proximity propagation clustering algorithm, and an optimal solution optimization ant colony algorithm is quickly searched in a Gaussian weighting mode. The ant colony optimization is improved, a radial basis network is introduced, the speed of local optimal solution search and sample training is increased, and a personal transaction behavior portrait and a transaction anomaly detection model of a user are obtained.

Drawings

The above and other objects, features and advantages of the present disclosure will become more apparent from the following description of embodiments of the present disclosure with reference to the accompanying drawings, in which:

fig. 1 schematically illustrates an application scenario of a method of training a neural network, a behavior detection method, and a behavior detection apparatus according to an embodiment of the present disclosure;

FIG. 2 schematically illustrates an exemplary system architecture to which the method of training a neural network, the behavior detection method, and the behavior detection apparatus may be applied, according to embodiments of the present disclosure;

FIG. 3 schematically illustrates a flow diagram of a method of training a neural network, in accordance with an embodiment of the present disclosure;

FIG. 4 schematically illustrates a structural schematic of a neural network according to an embodiment of the present disclosure;

FIG. 5 schematically illustrates a flow chart for improving an ant colony algorithm, according to an embodiment of the disclosure;

FIG. 6 schematically illustrates an optimal path diagram according to an embodiment of the disclosure;

FIG. 7 schematically illustrates a flow diagram of a method of training a neural network according to another embodiment of the present disclosure;

FIG. 8 schematically illustrates a flow chart of an abnormal behavior detection method according to an embodiment of the present disclosure;

FIG. 9 schematically illustrates a logic diagram of an abnormal behavior detection method according to an embodiment of the present disclosure;

fig. 10 schematically shows a block diagram of an abnormal behavior detection apparatus according to an embodiment of the present disclosure;

fig. 11 schematically illustrates a system architecture diagram of an abnormal behavior detection system according to an embodiment of the present disclosure; and

FIG. 12 schematically shows a block diagram of an electronic device according to an embodiment of the disclosure.

Detailed Description

Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It should be understood that the description is illustrative only and is not intended to limit the scope of the present disclosure. In the following detailed description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the disclosure. It may be evident, however, that one or more embodiments may be practiced without these specific details. Moreover, in the following description, descriptions of well-known structures and techniques are omitted so as to not unnecessarily obscure the concepts of the present disclosure.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. The terms "comprises," "comprising," and the like, as used herein, specify the presence of stated features, steps, operations, and/or components, but do not preclude the presence or addition of one or more other features, steps, operations, or components.

All terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art unless otherwise defined. It is noted that the terms used herein should be interpreted as having a meaning that is consistent with the context of this specification and should not be interpreted in an idealized or overly formal sense.

Where a convention analogous to "at least one of A, B and C, etc." is used, in general such a construction is intended in the sense one having skill in the art would understand the convention (e.g., "a system having at least one of A, B and C" would include but not be limited to systems that have a alone, B alone, C alone, a and B together, a and C together, B and C together, and/or A, B, C together, etc.). Where a convention analogous to "A, B or at least one of C, etc." is used, in general such a construction is intended in the sense one having skill in the art would understand the convention (e.g., "a system having at least one of A, B or C" would include but not be limited to systems that have a alone, B alone, C alone, a and B together, a and C together, B and C together, and/or A, B, C together, etc.). The terms "first", "second" and "first" are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more features.

With the rise of the wave of the internet plus, the application of the internet to upgrade the traditional industry to perform industrial enabling and intelligent upgrading is a great trend, and more traditional commercial transactions such as bank finance, e-commerce logistics and the like are transferred to the online. At the same time, the convenient payment transaction technology also brings the risk of transaction fraud and fund theft. The abnormal behavior in the transaction process is detected and identified, the abnormal transaction and the fraudulent transaction are intercepted, the risk of stealing the user funds is reduced, the transaction safety of the user and a company is guaranteed, and a practical and effective transaction abnormality detection system is established.

In the related technology, the traditional transaction abnormity detection method adopts a simple limit range rule detection method, and if the single-day transfer amount of a common user does not exceed a 5000 threshold value, an alarm is given to intercept if the single-day transfer amount exceeds the threshold value. Although a transaction abnormity identification method for threshold range detection exists at present, the accuracy of transaction abnormity detection by the method is low, and misjudgment is easy to occur. How to carry out personalized customization according to the personal consumption transaction habits of each user to calculate the normal transaction threshold values of different users, and then identify transaction fraud or error transactions, thereby reducing the abnormal transaction risk of the users, which is a difficult problem to solve urgently.

Because the daily transaction data scale of all users is massive, the transaction anomaly detection and identification of different users are personalized. Therefore, the machine learning, particularly the neural network method is adopted to carry out transaction self-learning to finish the personal transaction behavior portrait and the transaction abnormity detection. The method for training the neural network comprises a training data input process and a network parameter adjusting process, wherein the training data input process comprises the step of transferring training data by using neural network processing resources, the network parameter adjusting process is started after the training data input process is completed, at least the network parameter value of a hidden layer is adjusted based on a gradient descent method, so that the clustering center of the neural network approaches to the clustering center obtained through a clustering algorithm, a first network parameter value is obtained, and the behavior type comprises a normal behavior type and an abnormal behavior type. Wherein, this neural network includes: the input layer is used for transmitting the resource transfer training data to the hidden layer; the hidden layer is used for mapping the resource transfer training data from the low-dimensional space to at least one specified dimension of the high-dimensional space to obtain an output result aiming at the at least one specified dimension; and the output layer is used for outputting the output result aiming at the at least one specified dimension so as to determine the user resource transfer behavior portrait and the resource transfer abnormity detection model based on the output result aiming at the at least one specified dimension.

In view of the above, the disclosed embodiments generate a personal transaction behavior representation and a resource transfer anomaly detection model by this method according to a user's historical transaction record. And then, according to the user resource transfer behavior image identification and resource transfer abnormity detection model, carrying out similarity comparison on the current transaction to obtain a resource transfer abnormal value, thereby identifying abnormal behaviors and fraudulent behaviors and carrying out abnormal resource transfer behavior control and interception.

Fig. 1 schematically illustrates an application scenario of a method for training a neural network, a behavior detection method, and a behavior detection apparatus according to an embodiment of the present disclosure. The resource transfer is exemplified in fig. 1 as a transaction scenario.

As shown in fig. 1, a user transaction behavior representation generated based on historical transaction data of a user, wherein the user transaction behavior representation includes: the transaction related dimension information comprises transaction time periods, transaction types, transaction address information, transaction medium tools, transaction amount thresholds and the like, wherein each dimension has a corresponding value range, and the value range can be used as a transaction abnormity detection model so as to detect abnormal transactions. For example, the common transaction for the user in FIG. 1 is a WeChat payment or a credit card payment. The transaction category is an online purchase or a brick and mortar purchase. The common transaction time is 12: 00-13: 00 or 19: 00-23: 00. The transaction amount threshold is 20000 (dollars), or for finer categories: such as 600 for cosmetics and 2000 for apparel. The frequency of transactions was 80 \ months, or for a finer category: 8 times \ day in the beginning of the month and 3 times \ day in the end of the month. Common transaction addresses (e.g., IP addresses) x.x.x.x or communication addresses, or for a finer classification: site 1: a.a.a.a, site 2: b.b.b, where site 1 may be an office site, site 2 may be a residential site, etc.

After the user transaction behavior portrait and the transaction abnormity detection model are constructed, the probability that the current transaction request belongs to the abnormal transaction can be conveniently determined so as to carry out abnormal transaction control or normal transaction processing.

It should be noted that the above illustrated scenarios are only examples and are not limited herein. For example, the method can also be used for detecting abnormal behaviors in various scenes, such as network resource requests and the like.

Fig. 2 schematically illustrates an exemplary system architecture to which the method of training a neural network, the behavior detection method, and the behavior detection apparatus may be applied, according to an embodiment of the present disclosure. It should be noted that fig. 2 is only an example of a system architecture to which the embodiments of the present disclosure may be applied to help those skilled in the art understand the technical content of the present disclosure, and does not mean that the embodiments of the present disclosure may not be applied to other devices, systems, environments or scenarios. It should be noted that the method for training a neural network, the behavior detection method, and the behavior detection apparatus provided in the embodiments of the present disclosure may be used in the field of artificial intelligence to detect abnormal behaviors in a related aspect, and may also be used in various fields other than the field of artificial intelligence, such as the financial field.

As shown in fig. 2, the system architecture 200 according to this embodiment may include

terminal devices

201, 202, 203, a network 204 and a server 205. The network 204 may include a plurality of gateways, routers, hubs, network wires, etc. to provide a medium for communication links between the

end devices

201, 202, 203 and the server 205. Network 204 may include various connection types, such as wired, wireless communication links, or fiber optic cables, to name a few.

The user may use the

terminal devices

201, 202, 203 to interact with other terminal devices and the server 205 through the network 204 to receive or send information and the like, such as sending model training instructions, abnormal behavior detection instructions, resource transfer data, abnormal behavior detection results and the like. The

terminal devices

201, 202, 203 may be installed with various communication client applications, such as an abnormal behavior detection application, a bank application, an e-commerce application, a web browser application, a search application, an office application, an instant messaging tool, a mailbox client, social platform software, etc. (just examples).

The

terminal devices

201, 202, 203 include, but are not limited to, smart phones, desktop computers, augmented reality devices, tablet computers, remote video surveillance terminals, laptop portable computers, and other electronic devices that can support abnormal behavior detection, image processing, and the like. The terminal device can be stored with a neural network for abnormal behavior detection.

The server 205 may receive and process model training requests, abnormal behavior detection requests, model download requests, and the like. For example, the server 205 may be a back office management server, a cluster of servers, or the like. The background management server can analyze and process the received service request, information request and the like, and feed back processing results (such as abnormal behavior detection results, network parameters obtained by training a model and the like) to the terminal equipment.

It should be noted that the training neural network and the abnormal behavior detection method provided by the embodiment of the present disclosure may be executed by the

terminal devices

201, 202, and 203 or the server 205. Accordingly, the abnormal behavior detection apparatus provided by the embodiment of the present disclosure may be disposed in the

terminal device

201, 202, 203 or the server 205. It should be understood that the number of terminal devices, networks, and servers are merely illustrative. There may be any number of terminal devices, networks, and servers, as desired for implementation.

Fig. 3 schematically shows a flow diagram of a method of training a neural network according to an embodiment of the present disclosure. To facilitate understanding of the embodiments of the present disclosure, the following is an exemplary description taking a transaction scenario as an example.

As shown in fig. 3, the method includes operations S302 to S304.

In operation S302, training data is transferred using a neural network processing resource.

In this embodiment, the neural network may include: an input layer, a hidden layer, and an output layer.

The neural network may be a radial basis function neural network, a convolutional neural network, or the like, which can implement machine learning.

Specifically, the input layer is used to transmit resource transfer training data to the hidden layer. The hidden layer is used for mapping the resource transfer training data from the low-dimensional space to at least one specified dimension of the high-dimensional space to obtain an output result aiming at the at least one specified dimension. The output layer is used for outputting the output result aiming at the at least one specified dimension so as to determine the user resource transfer behavior portrait and the resource transfer abnormity detection model based on the output result aiming at the at least one specified dimension.

In one embodiment, the at least one specified dimension includes: at least one of transaction related information such as common resource transfer mode, resource transfer category, common resource transfer time, resource transfer amount threshold, previous resource transfer detection result, resource transfer frequency, transaction address and common resource transfer address.

For example, the resource transfer training data may include: current transaction data, historical consumption streams, third party payment information, credit investigation information, and the like. The current transaction information may include data, which is obtained through the bank interface and the third-party interface, that the transaction content of the current transaction, such as the transaction account, the transaction category, the timestamp and the payment amount, can locate the current transaction. The historical consumption information can comprise all information such as related transaction records of the garment accommodation row related to fund flow and online payment records of recharging water, electricity and gas with telephone fees, wherein only the current account Identification (ID) is collected. The third party payment information can comprise third party card binding information of a user binding a current account such as a bank card number ID and all online consumption records related to online payment consumption and the like, and is obtained by inquiring a third party calling interface and returning information. The credit investigation inquiry information of the user can be included in the data acquisition range, and the debit and credit condition and overdue record of the user are important evidence records for constructing the current transaction information elements of the user by reference, and can be acquired by inquiring through a people credit investigation system.

In one embodiment, the neural network comprises a radial basis neural network. The activation function of the hidden layer is a gaussian base function. The network parameters of the hidden layer comprise the hidden layer basic function center, the basic function width, the number of hidden layer nodes and the connection weight of the output nodes.

In operation S304, at least the network parameter value of the hidden layer is adjusted based on the gradient descent method, so that the cluster center of the neural network approaches the cluster center obtained by the clustering algorithm, and a first network parameter value is obtained, where the behavior type includes a normal behavior type and an abnormal behavior type.

For example, a user transaction behavior portrait of the user is obtained through training and learning of a radial Basis Function network (RBF network for short), and a transaction anomaly detection model corresponding to the individual is generated. The user transaction behavior portrait part is mainly personal transaction behavior information such as common transaction modes (such as WeChat payment), common transaction time (such as 09:00-21:00), transaction amount threshold (personalized transaction maximum threshold calculated according to transaction habits of each person) and transaction types (such as Taobao shopping) of the user within a period of time, which are obtained according to a transaction evaluation process.

The basic principle of the radial basis RBF network is firstly explained, and then the algorithm flow of the improved ant colony algorithm based on the RBF network is explained in detail.

When processing large-scale discrete and well-correlated data sets, the RBF radial basis network can perform large-scale data fusion at high speed and in parallel compared with other neural networks, has better self-learning self-adaptability, quicker timeliness for completing global optimal convergence, more stable topological structure of the RBF network and the like. Meanwhile, the process of obtaining the user transaction behavior portrait and generating the abnormal transaction detection model by the transaction data set processed in the transaction scene is essentially a nonlinear mapping process of firstly mapping large-scale transaction data from a low latitude space to a high-dimensional space and then mapping the high-dimensional space to the low latitude space. In summary, in the embodiment, the RBF network is selected as the basis for detecting transaction anomalies.

Fig. 4 schematically shows a structural schematic diagram of a neural network according to an embodiment of the present disclosure.

As shown in fig. 4, the RBF radial basis network is a typical three-layer feedback neural network, comprising an input layer, a hidden layer, and an output layer.

In one embodiment, adjusting at least the network parameter value of the hidden layer based on a gradient descent method and a clustering algorithm makes the output of the neural network approach to the behavior type of the resource transfer training data, and obtaining the first network parameter value may include the following operations.

Firstly, correcting the network parameter value of the hidden layer along the gradient descending direction of the target function through gradient descending to minimize an error function, and obtaining an initial network parameter value.

Then, optimizing the initial network parameter value based on a clustering algorithm to obtain a first network parameter value.

In one embodiment, a resource transfer anomaly detection model is constructed by training error accuracy using a gradient descent method.

In one particular embodiment, the input layer: the layer is used for receiving a transaction element set and transmitting normalized transaction data to a hidden layer by an RBF (radial basis function) network, each input data of the layer corresponds to one neuron node, the fused transaction data is assumed to have m dimensions, and the corresponding m-dimensional input vector is X ═ X (X-dimension)₁,x₂,...x_m)^T。

Hidden layer: the hidden layer of the RBF network is also called a radial base layer, and the layer is used for mapping transaction data transmitted by an input layer from a low latitude space to a high dimensional space so as to solve the problem that the low latitude cannot be mapped. The layer takes the radial basis function as an activation function for the corresponding transaction data. The radial basis function is a centrosymmetric and radial weak nonlinear function, and the expression is shown as formula (1).

In the formula (1), C_iRepresents the center of the node corresponding to the ith hidden layer, | X-C_i|²Denotes X and C_iOf Euclidean distance, σ_iThe ith basis function width is represented and h represents the number of hidden layer nodes.

Basis functions: common basis functions include a cauchy radial basis function, a quadratic polynomial radial basis function and a gaussian radial basis function, r represents the distance from sample data to a data center, the gaussian basis function is selected as the basis function of the RBF network in the embodiment of the disclosure, and the expression is shown in formula (2).

In the formula (2), sigma represents the hidden layer neuron width,

representing the corresponding radial basis function.

And the output layer has the main function of continuously carrying out high-dimensional mapping on the input transaction number set according to a training method to finally obtain a corresponding output result Ym, and the plurality of output results form a corresponding user transaction behavior portrait. In the process, the data model for training and feeding is continuously and iteratively trained, and finally the precision requirement is met. The method comprises the steps of initializing a clustering center and variance of the RBF network by selecting a gradient descent method, then training error precision by using the gradient descent method to construct a transaction abnormity detection model, and carrying out continuous gradient descent on a radial basis center C_iVariance width b_iAnd neuron node weights w_iAnd correcting along the gradient descending direction of the objective function until the gradient is 0 or meets the precision requirement.

The gradient descent method step may include the following three stages.

Stage one, firstly, initializing an error function e_jAnd an objective function E, expressed as formula (3):

stage two, according to e in the formula (4-8)_jCorresponding parameter at minimum value and output weight w_jiAnd obtaining the gradient descent training method of each parameter of the radial basis network.

Center c_iThe correction direction is as follows:

width b_iThe correction direction of (1) is:

weight w_iThe correction direction of (1) is:

stage three, therefore, the gradient of the above parameters is reduced as shown in equation (4):

with respect to the formula (4) above,

representing hidden layer node i vs. data x_jInput Gaussian function of, mu therein₁,μ₂,μ₃Indicating the learning rate.

As can be seen from the training process of the RBF network, the number of adjustable parameters of the RBF radial basis network, namely the convergence accuracy control parameters, is 4, and the number is respectively the center c of the hidden layer basis function_iThe width of the basis function σ_iThe number m of hidden layer nodes and the connection weight w of the output node_ij。

The process of transaction data set training can be abstracted into nonlinear mapping of large-scale transaction data so as to obtain a transaction behavior portrait and a transaction anomaly detection model. Although RBF networks were chosen as the model basis. The embodiment of the present disclosure solves the above problems, and optimizes the RBF network in a clustering manner, for example, optimizes 4 parameters of the RBF network.

In one embodiment, optimizing the initial network parameter value based on the clustering algorithm to obtain the first network parameter value may include the following operations.

First, the location of the ant colony, which characterizes the clustering center of the network, and the pheromones are initialized.

Then, the following operations are repeated until the iteration times reach the iteration requirement or the clustering result meets the precision requirement: calculating an ant colony similarity matrix, a homing matrix and an attraction matrix aiming at a clustering center by utilizing a proximity propagation clustering algorithm; determining a bias parameter according to the similarity matrix, and updating the attraction matrix; and updating the degree of homing matrix according to the attraction matrix, and obtaining a clustering result. Therefore, the position of the ant colony is used as supervision information, the neural network is trained, the initial network parameter value is updated, and the first network parameter value is obtained.

In addition, in order to accelerate the network convergence speed and further improve the network prediction accuracy, a gaussian variation factor can be introduced in the process of searching the ant colony optimal solution so as to improve the network convergence speed.

For example, introducing gaussian variation in finding the optimal solution to increase the speed of network convergence may include the following operations.

Firstly, a Gaussian variation factor is introduced in the process of searching the ant colony optimal solution to obtain the individual pheromone concentration, the variation probability, the maximum pheromone and the average pheromone of the ant colony.

And then, calculating a Gaussian weighted global optimum factor of the ant colony by using the normal distribution mean value and the weighted extreme value of the individual pheromones of the ant colony and taking the minimum pheromone value as a Gaussian weighted central value, wherein the mean value and the variance of the pheromone concentration are taken as corresponding values of Gaussian variation weighting.

And then, taking the value obtained by carrying out weighted average on at least part of ant individual pheromone optimal factors and Gaussian weighted global optimal factors as the global optimal pheromone solution of the ant colony.

For example, the core of the RBF network is the hidden layer, and the key is the initialization center and kernel function selection of the hidden layer. The embodiment of the present disclosure selects, as a Radial Basis network optimization method in the embodiment of the present disclosure, an improved ant Colony Algorithm optimized Radial Basis Function (APCA-RBF) obtained by improving an ant Colony Algorithm using an Affinity Propagation (AP) cluster and a gaussian variation factor.

Fig. 5 schematically illustrates a flow chart of an improved ant colony algorithm according to an embodiment of the present disclosure.

As shown in fig. 5, the algorithm mainly comprises 3 parts: first, the AP cluster initializes the ant colony to complete the clustering. And then, introducing Gaussian variation when searching an optimal solution, and accelerating convergence and updating the ant colony state. And then, updating the pheromone and the position of the ant colony to obtain an optimal solution. The APCA algorithm includes the following eight stages.

Stage 1, initializing the position x of the ant colony M_iAnd pheromone tau_jThe expression is shown in formula (5).

In formula (5), x_iDenotes the location of the ith ant, τ_jiIndicates the pheromone concentration, tau, of the ith ant to the jth path_jThe pheromone concentration passed by all ants on the jth path is shown.

And 2, utilizing AP clustering to calculate an ant colony similarity matrix S, a degree of repose matrix A and an attraction matrix R, selecting a point k as a clustering center, and showing a related formula as a formula (6).

Stage 3, determining a bias parameter p according to the similarity_k,k∈[1,2,...n]Then, the attraction degree matrix R is updated, and the calculation formula is shown in formula (7).

And 4, updating the degree of repose A according to the attraction degree matrix R, wherein the expression is shown as the formula (8).

And 5, obtaining a clustering result, and judging whether the ant colony clustering meets the precision requirement or exceeds the iteration requirement.

And 6, introducing a Gaussian variation factor in the process of searching the ant colony optimal solution. Obtaining ant colony individual pheromone concentration tau of transaction data set_jiProbability of variation p_jiMaximum pheromone τ_jimaxMean pheromone τ_jiavgThe variation probability calculation formula is shown as formula (9).

In the formula (4-14), the first,

after calculation

May be 0.8 and 0.5, respectively.

Stage 7, introducing Gaussian variation accelerated convergence in the later stage of searching the global optimal solution by the ant colony algorithm, and enabling g (x) to be obtained by adopting the normal distribution mean value and the weighted extreme value of the individual pheromone of the ant colony_i)＝τ_jiThe individual pheromones are represented, so the mean and variance calculation formula of the pheromones is shown in formula (10).

In the formula (10), the mean and variance of the pheromone concentration are used as corresponding values of the gaussian variation weights. Then, the minimum pheromone value is obtained as g_min＝min{g(x₁),g(x₂),...g(x_m) It is taken as the gaussian weighted center value. And then calculating a Gaussian weighted global optimum factor of the ant colony, as shown in a formula (11).

Stage 8, optimizing all ant individual pheromones g for improving ant colony algorithm_bestSum Gaussian weighted global optimum factor

Carrying out weighted average, and taking the obtained value as the global optimal pheromone solution G of the ant colony M_bestThe expression is shown in formula (12):

after the operations are completed, the convergence and the accuracy of the APCA algorithm are improved, and the efficiency and the convergence of the hidden layer can be improved in a subsequent RBF network training model.

In one embodiment, the method may further include the following operations. After the first network parameter value is obtained, the neural network is used for processing resource transfer test data training to fine-tune the network parameter value, and a second network parameter is obtained.

For example, processing resource transfer test data training with a neural network to fine-tune network parameter values includes: repeating the following operations until an iteration end condition of the ant colony is reached: determining an ant colony state corresponding to an optimal pheromone solution and an adaptive value corresponding to the resource transfer training data; and calculating Gaussian weighting to obtain an ant colony global optimal pheromone and a path solution, and updating the pheromone concentration and the position of the iterative ant colony state according to the individual pheromone. It should be noted that the process of adjusting the network parameters by using the test data may be the same as the process of adjusting the network parameters by using the training data, and is not limited herein.

Fig. 6 schematically illustrates an optimal path diagram according to an embodiment of the disclosure.

As shown in the left diagram of fig. 6, the diagram includes six positions a to E, where C and H have obstacles therebetween and the ant colony cannot pass through, so the ant colony can move from position B to position H, and can also detour from position B or position C. Wherein the distance D between the position B and the position H and between the position H and the position D is 1, and the distance D between the position B and the position C and between the position C and the position D is 0.5. As shown in the middle graph of fig. 6, when t is 0, the pheromone of each route is 15. As shown in the right diagram of fig. 6, at time t ═ 1, pheromones of the respective paths change, where pheromones between position B and position H, between position H and position D are 10, and pheromones between position B and position C, between position C and position D are 20.

Since the data from different sources, the respective data formats, etc. are different, and the data may include noise information, the data from different sources may be processed first, so as to process the preprocessed data by using the model.

According to the embodiment of the disclosure, a user transaction behavior portrait is generated by the method according to the historical transaction records of the user, and the transaction behavior portrait comprises transaction related information such as transaction time periods, transaction types, transaction geographic information, transaction medium tools, transaction amount thresholds and the like. Therefore, the similarity comparison is conveniently carried out on the current transaction according to the user transaction behavior image to obtain a transaction abnormal value, so that abnormal transactions and fraudulent transactions are identified, and the abnormal transactions are controlled and intercepted. The APCA-RBF-based user transaction abnormity detection method has the following advantages: the user transaction behavior portrait of different users can be generated in a personalized mode, and the user transaction behavior portrait is easy to update in a self-learning mode.

Fig. 7 schematically illustrates a flow diagram of a method of training a neural network according to another embodiment of the present disclosure.

As shown in fig. 7, the method may further include operation S702 before operation S302.

In operation S702, the resource transfer training data is normalized to obtain normalized resource transfer training data.

Because the data sources of the transaction information are various and the formats of the transaction information are different, the transaction data are required to be cleaned redundantly, and the transaction missing value supplement and the transaction relevance are fused to obtain an available transaction information set. The redundant cleaning adopts nonlinear wavelet transformation, the missing value supplement adopts an improved Smote algorithm, and the relevance fusion adopts an information entropy algorithm.

Accordingly, the input layer is specifically configured to transmit the normalized resource transfer training data to the hidden layer.

In one embodiment, normalizing the resource transfer training data to obtain normalized resource transfer training data includes: and performing at least one of data redundancy cleaning, resource transfer missing value supplement and resource transfer relevance fusion on the historical resource transfer training data to obtain normalized resource transfer training data.

For example, performing data redundancy scrubbing includes the following operations.

First, wavelet transform is performed on resource transfer data from different sources.

And then, performing threshold processing on the obtained wavelet coefficient by adopting an activation function.

And then, carrying out inverse wavelet transformation on the coefficient subjected to threshold processing to obtain redundancy-removed resource transfer data.

In a specific embodiment, the nonlinear wavelet transform performs redundant data washing, and the redundant data washing step may include the following operations.

Firstly, the multi-source transaction data is decomposed, predicted and updated by adopting a Mallat algorithm to perform wavelet transformation.

Then, the obtained wavelet coefficients are subjected to threshold processing by adopting a Sigmod function.

And then, carrying out inverse wavelet transformation on the coefficient subjected to threshold processing to obtain redundancy-removed transaction data.

The Sigmod function may be represented by equation (13).

In formula (13), x_i,μ,f(x_i) Respectively representing the transaction data before threshold processing, and the transaction data after the mean value of the transaction data is changed by Sigmod.

In one embodiment, resource transfer miss value supplementation includes the following operations.

And for the incomplete resource transfer sample, calculating the distance from the incomplete resource transfer sample to at least part of samples in the resource transfer sample set by taking the Euclidean distance as a standard to obtain the k neighbor of the incomplete resource transfer sample.

Setting a sampling ratio according to the sample imbalance ratio to determine a sampling magnification, wherein for each resource transfer sample, a sample is randomly selected from k neighbors based on the sampling magnification; and

and for each randomly selected sample, respectively constructing a new sample with the original sample according to a preset rule so as to obtain the resource transfer data after the missing value is supplemented.

In a specific embodiment, missing value supplementation is performed by sampling the Smote algorithm, and may include the following operations.

Firstly, for an incomplete trading sample x, the distance from the incomplete trading sample x to all samples in the trading sample set is calculated by taking the Euclidean distance as a standard, and k neighbors of the incomplete trading sample x are obtained.

Then, a sampling ratio is set according to the sample imbalance ratio to determine a sampling rate N, for each transaction sample x_iRandomly select a number of samples from its k neighbors, assuming the selected neighbor is x_j。

Then, for each randomly selected neighbor x_jAnd respectively constructing a new sample according to the formula (14) with the original sample to obtain the transaction data after supplementing the missing value.

x_j＝x_i+rand(0,1)*(x_j-x_i) Formula (14)

In one embodiment, resource transfer affinity fusion may include the operations shown below.

First, an information entropy value of a resource transfer sample is selected.

Then, the difference degree between the resource transfer sample data and the residual resource transfer sample information set is calculated.

And then, calculating the relevance of at least part of the resource transfer data through the uncertainty and the difference degree, and sequencing to obtain a fused resource transfer data set.

For example, the information entropy is subjected to transaction relevance fusion, and the step of relevance fusion comprises the following steps:

firstly, selecting and calculating the information entropy value H of a transaction sample i_jAs shown in formula (15).

In the formula (15), r_ij,f_ijRespectively representing the correlation and uncertainty probability of the jth data with the remaining data set.

Then, calculating the difference degree g between the sample data and the residual transaction information set_jAs shown in formula (16).

In the formula (16), E_nAnd μ represents the information entropy and the entropy mean of all data, respectively.

Next, the relevance y of all transaction data is calculated based on uncertainty and difference, as shown in equation (17)_iAnd then ordering to obtain a fused transaction element set.

In the formula (17), g_j,f_ijRepresenting the degree of difference and uncertainty, respectively.

According to the embodiment of the disclosure, transaction data are subjected to the redundancy cleaning, missing value supplement and relevance fusion processes to generate transaction data sets with good integrity, the transaction data sets are divided into test data and training data according to requirements, and then model training and testing can be performed to obtain a user transaction behavior portrait and a resource transfer abnormity detection model. The personal user image is generated by adopting an APCA-RBF network to evaluate the transaction behavior so as to obtain a personal transaction image.

Another aspect of the present disclosure provides an abnormal behavior detection method.

Fig. 8 schematically shows a flow chart of an abnormal behavior detection method according to an embodiment of the present disclosure.

As shown in fig. 8, the abnormal behavior detection method may include operations S802 to S806.

In operation S802, a resource transfer request is obtained, the resource transfer request including resource transfer data. Wherein the resource transfer request may be a transaction request, etc.

In operation S804, the trained neural network is used to process the resource transfer data, so as to obtain a resource transfer abnormality detection model.

Wherein, the neural network can include: and the input layer is used for transmitting the resource transfer training data to the hidden layer. And the hidden layer is used for mapping the resource transfer training data from the low-dimensional space to at least one specified dimension of the high-dimensional space to obtain an output result aiming at the at least one specified dimension. The output layer is used for outputting an output result aiming at least one specified dimension so as to determine a user resource transfer behavior portrait and a resource transfer abnormity detection model based on the output result aiming at the at least one specified dimension;

for example, the neural network is trained as follows.

And at least adjusting the network parameter value of the hidden layer based on a gradient descent method, so that the clustering center of the neural network approaches to the clustering center obtained by a clustering algorithm to obtain a first network parameter value, wherein the behavior type comprises a normal behavior type and an abnormal behavior type.

For example, the resource transfer training data may include: current transaction data, historical consumption streams, third party payment information, credit investigation information, and the like.

In operation S806, the resource transfer data is processed based on the resource transfer abnormality detection model and the user resource transfer behavior profile to obtain a behavior type of the resource transfer data, so as to process the resource transfer request based on the behavior type of the resource transfer data.

For example, abnormal behavior detection mainly consists of three parts: APCA-RBF transaction behavior evaluation, user transaction behavior portrayal and transaction anomaly detection. And (3) obtaining a user transaction behavior portrait of the user through training and learning of the RBF radial basis function network by using a transaction data set obtained through transaction information fusion, and generating a transaction abnormity detection model corresponding to the individual. The user transaction behavior portrait part is mainly personal transaction behavior information such as common transaction modes (such as WeChat payment), common transaction time (such as 09:00-21:00), transaction amount threshold (personalized transaction maximum threshold calculated according to transaction habits of each person) and transaction types (such as Taobao shopping) of the user within a period of time, which are obtained according to a transaction evaluation process. And then carrying out similarity evaluation on the current transaction request and the user transaction behavior portrait to obtain a quantified transaction abnormity evaluation score, then carrying out abnormal transaction control according to a transaction control strategy, and if the abnormal transaction is intercepted, doubt is required to be confirmed by the user, and the normal transaction is allowed to pass.

Regarding transaction behavior evaluation, the fused transaction element set is a discrete data record, when processing a large-scale discrete and relatively good-relevance data set, the RBF network can perform large-scale data fusion at high speed and in parallel compared with other neural network RBF networks which process nonlinear mapping, and has the excellent characteristics of better self-learning adaptability, higher timeliness, more stable topological structure and the like, so the RBF network is selected as the basis of a transaction behavior evaluation model. The embodiment of the disclosure utilizes the APCA-RBF optimized based on the improved ant colony algorithm to evaluate the transaction behavior. And (4) training an APCA-RBF model by using the fused transaction element set to obtain a user transaction behavior portrait and a corresponding transaction abnormity evaluation model. After model training is completed, current transaction information is input into a transaction anomaly detection model and similarity analogy is carried out on the current transaction information and the user transaction behavior portrait so as to carry out anomaly detection.

And processing the user transaction behavior portrait through an APCA-RBF network according to information of personal consumption transactions such as a common transaction mode (type), a transaction category (category), common transaction time (time), a transaction amount threshold, a transaction detection result, transaction frequency (rate) and a common transaction address (such as an IP address) of the user within a period of time, which is obtained in a transaction evaluation process, of the user to obtain the user transaction behavior portrait. The transaction behavior image correspondence information is shown in table 1:

TABLE 1 user transaction behavior image information Table

Regarding transaction anomaly detection: the transaction behavior portrait of the user and the transaction abnormity detection model obtained by the APCA-RBF transaction behavior evaluation can be used for evaluating transaction abnormity of the transaction information by using the abnormity detection model, similarity matching is carried out on the transaction information and the transaction behavior portrait of the user, and the transaction evaluation result and the similarity matching result are integrated to obtain an abnormity evaluation score of the current transaction. Then, the transaction abnormal behavior detection and the corresponding control can be performed according to the transaction control strategy table 2. Wherein the anomaly evaluation score is less than 40 and the transaction passes; the abnormal evaluation score is higher than 70, and the transaction is directly intercepted; the evaluation score is 40-70, and the client is required to confirm the transaction (such as short message verification or telephone verification) and then perform corresponding control.

TABLE 2 transaction control policy Table

User transaction evaluation scores	Transaction anomaly detection result	Transaction control strategy
			0 minute to 39 minutes	Whether or not	By passing
40 to 70 minutes	In doubt	Requiring user confirmation
			71 to 100 points	Is that	Interception

The following describes a specific process for optimizing the RBF radial basis network for user transaction evaluation by using an APCA algorithm. The APCA-RBF network model can be used for generating a user transaction behavior portrait and a transaction anomaly detection model.

In the APCA-RBF transaction anomaly evaluation process, an APCA-RBF network is specifically utilized to generate a user transaction behavior portrait and transaction anomaly detection, AP clustering is adopted to complete ant colony clustering, and then an optimal solution optimization ant colony algorithm is quickly found in a Gaussian weighting mode. The ant colony optimization is improved, a radial basis network is introduced, the speed of local optimal solution search and sample training is increased, and a user transaction behavior portrait and a transaction anomaly detection model of a user are obtained.

Fig. 9 schematically illustrates a logic diagram of an abnormal behavior detection method according to an embodiment of the present disclosure.

As shown in FIG. 9, the APCA-RBF transaction anomaly evaluation process may be as follows.

Stage 1, dividing the transaction data set subjected to data fusion into test data and training data (for example, the ratio of the test data to the training data can be 7:3), and initializing ant colony M and ant position x_iAnd the concentration of the path pheromone τ_jThe expression is shown in formula (18):

stage 2, calculating the ant colony individual pheromone concentration of the transaction elements andsorting the data in descending order to obtain a minimum adaptive value g_minThe calculation formula is shown in formula (19).

And 3, clustering and dividing the ant colony by using an AP clustering algorithm to obtain the population difference A (i, k), and introducing variation factors, wherein important formulas are shown as a formula (20) and a formula (21).

And 4, calculating Gaussian weight to obtain ant colony global optimal pheromone and path solution g_bestAnd updating pheromone concentration tau of the iterative ant colony state according to the individual pheromones_jiAnd position x_iThe optimal solution solving formula is shown in formula (22).

And 5, judging iteration ending conditions of the APCA improved ant colony, judging according to the ant colony precision and the maximum iteration times, outputting an optimal ant colony parameter model when the expected precision is achieved, and otherwise, returning to the stage 2.

And 6, establishing an APCA-RBF user transaction abnormal quota detection model according to the optimal parameters, and introducing test data and training data.

Stage 7, applying sequence y of current transaction_i＝{y₁,y₂,...y_n}^TAnd inputting the user transaction evaluation model to obtain a transaction evaluation result.

And 8, performing abnormity detection and corresponding control according to the personal portrait of the user transaction and the evaluation result. It should be noted that, the process of detecting abnormal behavior may refer to the process related content of detecting abnormal behavior involved in the above neural network training process, and will not be described in detail here.

On one hand, the transaction abnormity detection method provided by the embodiment of the disclosure adopts APCA-RBF to detect transaction abnormity, so that the user transaction behavior portrait of different users can be generated in a personalized manner, and the user transaction behavior portrait is easy to update by self-learning. On one hand, the APCA-RBF network can be used for more accurately detecting abnormal transactions, and then transaction interception, transaction confirmation and transaction passing are carried out according to the detection result, so that economic loss caused by abnormal transactions is reduced. The embodiment of the disclosure can more accurately detect abnormal transactions, and then perform transaction interception, transaction confirmation and transaction passing according to the detection result, thereby reducing economic loss caused by abnormal transactions.

Fig. 10 schematically shows a block diagram of an abnormal behavior detection apparatus according to an embodiment of the present disclosure.

As shown in fig. 10, the abnormal behavior detection apparatus 1000 may include: a request acquisition module 1010, a data processing module 1020, and a behavior type determination module 1030.

The request obtaining module 1010 is configured to obtain a resource transfer request, where the resource transfer request includes resource transfer data.

The data processing module 1020 is configured to process the resource transfer data by using the trained neural network to obtain a resource transfer abnormality detection model.

The behavior type determining module 1030 is configured to process the resource transfer data based on the resource transfer anomaly detection model and the user resource transfer behavior sketch to obtain a behavior type of the resource transfer data, so as to process the resource transfer request based on the behavior type.

For example, neural networks include: the input layer is used for transmitting the resource transfer training data to the hidden layer; the hidden layer is used for mapping the resource transfer training data from the low-dimensional space to at least one specified dimension of the high-dimensional space to obtain an output result aiming at the at least one specified dimension; and the output layer is used for outputting the output result aiming at the at least one specified dimension so as to determine the user resource transfer behavior portrait and the resource transfer abnormity detection model based on the output result aiming at the at least one specified dimension.

The neural network is trained by: and at least adjusting the network parameter value of the hidden layer based on a gradient descent method, so that the clustering center of the neural network approaches to the clustering center obtained by a clustering algorithm to obtain a first network parameter value, wherein the behavior type comprises a normal behavior type and an abnormal behavior type.

In one embodiment, the abnormal behavior detection system may include: the system comprises a resource transfer data acquisition module, a resource transfer element fusion module and a resource transfer abnormity detection module.

The resource transfer data acquisition module is used for acquiring current resource transfer data, historical resource transfer data, third-party payment information and credit investigation information so as to finish resource transfer data acquisition.

The resource transfer element fusion module is used for preprocessing the resource transfer data and fusing the resource transfer relevance to obtain a resource transfer data set.

The resource transfer abnormity detection module is used for training a neural network by using the resource transfer data set to obtain a user resource transfer behavior portrait and a resource transfer abnormity detection model, processing the current resource transfer data by using the trained neural network, and determining the probability that the current resource transfer data belongs to an abnormal behavior based on the processing result, the user resource transfer behavior portrait and the resource transfer abnormity detection model so as to perform resource transfer control.

Fig. 11 schematically illustrates a system architecture diagram of an abnormal behavior detection system according to an embodiment of the present disclosure.

As shown in fig. 11, the resource transfer data collection module collects current transaction data, historical consumption stream, third party payment information, credit investigation information, and the like of the user, so as to complete the collection of transaction element information.

The transaction element fusion module carries out transaction data redundancy cleaning on transaction data and the like with various data sources and different formats, and the available transaction information set is obtained by fusing transaction missing value supplement and transaction relevance. The redundant cleaning adopts nonlinear wavelet transformation, the missing value supplement adopts an improved Smote algorithm, and the relevance fusion adopts an information entropy algorithm.

The resource transfer abnormity detection module of the core comprises 4 parts: APCA-RBF transaction behavior evaluation, user transaction behavior portrayal, transaction anomaly detection and transaction control data feedback. And performing corresponding transaction abnormity identification according to the transaction strategy, wherein the transaction identified as abnormal is not intercepted.

It should be noted that the implementation, solved technical problems, implemented functions, and achieved technical effects of each module/unit and the like in the apparatus part embodiment are respectively the same as or similar to the implementation, solved technical problems, implemented functions, and achieved technical effects of each corresponding step in the method part embodiment, and are not described in detail herein.

Any of the modules, units, or at least part of the functionality of any of them according to embodiments of the present disclosure may be implemented in one module. Any one or more of the modules and units according to the embodiments of the present disclosure may be implemented by being split into a plurality of modules. Any one or more of the modules, units according to the embodiments of the present disclosure may be implemented at least partially as a hardware circuit, such as a Field Programmable Gate Array (FPGA), a Programmable Logic Array (PLA), a system on a chip, a system on a substrate, a system on a package, an Application Specific Integrated Circuit (ASIC), or may be implemented by any other reasonable means of hardware or firmware by integrating or packaging the circuits, or in any one of three implementations of software, hardware and firmware, or in any suitable combination of any of them. Alternatively, one or more of the modules, units according to embodiments of the present disclosure may be implemented at least partly as computer program modules, which, when executed, may perform the respective functions.

For example, any of the request obtaining module 1010, the data processing module 1020, and the behavior type determining module 1030 may be combined and implemented in one module, or any one of the modules may be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules may be combined with at least part of the functionality of the other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the request obtaining module 1010, the data processing module 1020, and the behavior type determining module 1030 may be implemented at least partially as a hardware circuit, such as a Field Programmable Gate Array (FPGA), a Programmable Logic Array (PLA), a system on a chip, a system on a substrate, a system on a package, an Application Specific Integrated Circuit (ASIC), or may be implemented in hardware or firmware in any other reasonable manner of integrating or packaging a circuit, or in any one of three implementations of software, hardware, and firmware, or in any suitable combination of any of them. Alternatively, at least one of the request obtaining module 1010, the data processing module 1020 and the behavior type determining module 1030 may be at least partially implemented as a computer program module, which when executed may perform a corresponding function.

FIG. 12 schematically shows a block diagram of an electronic device according to an embodiment of the disclosure. The electronic device shown in fig. 12 is only an example, and should not bring any limitation to the functions and the scope of use of the embodiments of the present disclosure.

As shown in fig. 12, an electronic apparatus 1200 according to an embodiment of the present disclosure includes a processor 1201, which can perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM)1202 or a program loaded from a storage section 1208 into a Random Access Memory (RAM) 1203. The processor 1201 may include, for example, a general purpose microprocessor (e.g., a CPU), an instruction set processor and/or associated chipset, and/or a special purpose microprocessor (e.g., an Application Specific Integrated Circuit (ASIC)), among others. The processor 1201 may also include on-board memory for caching purposes. The processor 1201 may include a single processing unit or multiple processing units for performing the different actions of the method flows according to embodiments of the present disclosure.

In the RAM 1203, various programs and data necessary for the operation of the electronic apparatus 1200 are stored. The processor 1201, the ROM 1202, and the RAM 1203 are communicatively connected to each other by a bus 1204. The processor 1201 performs various operations of the method flow according to the embodiments of the present disclosure by executing programs in the ROM 1202 and/or the RAM 1203. Note that the programs may also be stored in one or more memories other than the ROM 1202 and the RAM 1203. The processor 1201 may also perform various operations of method flows according to embodiments of the present disclosure by executing programs stored in the one or more memories.

Electronic device 1200 may also include input/output (I/O) interface 1205, according to an embodiment of the disclosure, input/output (I/O) interface 1205 also connected to bus 1204. The electronic device 1200 may also include one or more of the following components connected to the I/O interface 1205: an input section 1206 including a keyboard, a mouse, and the like; an output portion 1207 including a display device such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and the like, and a speaker; a storage section 1208 including a hard disk and the like; and a communication section 1209 including a network interface card such as a LAN card, a modem, or the like. The communication section 1209 performs communication processing via a network such as the internet. A driver 1210 is also connected to the I/O interface 1205 as needed. A removable medium 1211, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like, is mounted on the drive 1210 as necessary, so that a computer program read out therefrom is mounted into the storage section 1208 as necessary.

According to embodiments of the present disclosure, method flows according to embodiments of the present disclosure may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable storage medium, the computer program containing program code for performing the method illustrated by the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network through the communication section 1209, and/or installed from the removable medium 1211. The computer program, when executed by the processor 1201, performs the above-described functions defined in the system of the embodiments of the present disclosure. The systems, devices, apparatuses, modules, units, etc. described above may be implemented by computer program modules according to embodiments of the present disclosure.

The present disclosure also provides a computer-readable storage medium, which may be contained in the apparatus/device/system described in the above embodiments; or may exist separately and not be assembled into the device/apparatus/system. The computer-readable storage medium carries one or more programs which, when executed, implement the method according to an embodiment of the disclosure.

According to embodiments of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, which may include, for example but is not limited to: a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present disclosure, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. For example, according to embodiments of the present disclosure, a computer-readable storage medium may include the ROM 1202 and/or the RAM 1203 and/or one or more memories other than the ROM 1202 and the RAM 1203 described above.

Embodiments of the present disclosure also include a computer program product comprising a computer program containing program code for performing the method provided by the embodiments of the present disclosure, when the computer program product is run on an electronic device, the program code being configured to cause the electronic device to implement the image model training method or the abnormal behavior detection method provided by the embodiments of the present disclosure.

The computer program, when executed by the processor 1201, performs the above-described functions defined in the system/apparatus of the embodiments of the present disclosure. The systems, apparatuses, modules, units, etc. described above may be implemented by computer program modules according to embodiments of the present disclosure.

In one embodiment, the computer program may be hosted on a tangible storage medium such as an optical storage device, a magnetic storage device, or the like. In another embodiment, the computer program may also be transmitted, distributed in the form of a signal on a network medium, downloaded and installed through the communication section 1209, and/or installed from the removable medium 1211. The computer program containing program code may be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the foregoing.

In accordance with embodiments of the present disclosure, program code for executing computer programs provided by embodiments of the present disclosure may be written in any combination of one or more programming languages, and in particular, these computer programs may be implemented using high level procedural and/or object oriented programming languages, and/or assembly/machine languages. The programming language includes, but is not limited to, programming languages such as Java, C + +, python, the "C" language, or the like. The program code may execute entirely on the user computing device, partly on the user device, partly on a remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computing device (e.g., through the internet using an internet service provider).

Those skilled in the art will appreciate that various combinations and/or combinations of features recited in the various embodiments and/or claims of the present disclosure can be made, even if such combinations or combinations are not expressly recited in the present disclosure. These examples are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although the embodiments are described separately above, this does not mean that the measures in the embodiments cannot be used in advantageous combination. The scope of the disclosure is defined by the appended claims and equivalents thereof. Various alternatives and modifications can be devised by those skilled in the art without departing from the scope of the present disclosure, and such alternatives and modifications are intended to be within the scope of the present disclosure.

Claims

1. A method for training a neural network, the neural network comprising:

the input layer is used for transmitting the resource transfer training data to the hidden layer;

the hidden layer is used for mapping the resource transfer training data from a low-dimensional space to at least one specified dimension of a high-dimensional space to obtain an output result aiming at the at least one specified dimension; and

an output layer for outputting the output result for the at least one specified dimension so as to determine a user resource transfer behavior portrait and a resource transfer abnormity detection model based on the output result for the at least one specified dimension;

the method comprises the following steps:

processing the resource transfer training data with the neural network; and

and at least adjusting the network parameter value of the hidden layer based on a gradient descent method, so that the clustering center of the neural network approaches to the clustering center obtained by a clustering algorithm, and a first network parameter value is obtained.

2. The method of claim 1, wherein the adjusting at least the network parameter value of the hidden layer based on the gradient descent method such that the cluster center of the neural network approaches the cluster center obtained by the clustering algorithm, and obtaining the first network parameter value comprises:

correcting the network parameter value of the hidden layer along the gradient descending direction of the target function through gradient descending to minimize an error function and obtain an initial network parameter value; and

and optimizing the initial network parameter value based on a clustering algorithm to obtain the first network parameter value.

3. The method of claim 2, wherein the optimizing the initial network parameter value based on a clustering algorithm to obtain the first network parameter value comprises:

initializing the positions and pheromones of the ant colony, wherein the positions of the ant colony represent the clustering center of a network;

repeating the following operations until the iteration times reach the iteration requirement or the clustering result meets the precision requirement:

calculating an ant colony similarity matrix, a homing matrix and an attraction matrix aiming at the clustering center by utilizing a proximity propagation clustering algorithm;

determining a bias parameter according to the similarity matrix and updating the attraction matrix;

updating the homing degree matrix according to the attraction degree matrix to obtain a clustering result; and

and training the neural network by taking the position of the ant colony as supervision information so as to update the initial network parameter value to obtain the first network parameter value.

4. The method of claim 3, further comprising:

and introducing a Gaussian variation factor in the process of searching the ant colony optimal solution to improve the speed of network convergence.

5. The method of claim 4, wherein the introducing a Gaussian variation factor in finding an ant colony optimal solution to increase the speed of network convergence comprises:

introducing a Gaussian variation factor in the process of searching the ant colony optimal solution to obtain the concentration, variation probability, maximum pheromone and average pheromone of the individual pheromones of the ant colony;

calculating a Gaussian weighted global optimum factor of the ant colony by using a normal distribution mean value and a weighted extreme value of the individual pheromones of the ant colony and taking a minimum pheromone value as a Gaussian weighted central value, wherein the mean value and the variance of the pheromone concentration are taken as corresponding values of Gaussian variation weighting; and

and taking the value obtained by carrying out weighted average on at least part of ant individual pheromone optimal factors and Gaussian weighted global optimal factors as the global optimal pheromone solution of the ant colony.

6. The method of claim 1, further comprising: after obtaining the value of the first network parameter,

and processing the resource transfer test data by using the neural network for training so as to fine-tune the value of the first network parameter and obtain a second network parameter.

7. The method of claim 6, wherein the processing the resource transfer test data training with the neural network to fine tune network parameter values comprises:

repeating the following operations until an iteration end condition of the ant colony is reached:

determining an ant colony state corresponding to an optimal pheromone solution and an adaptive value corresponding to the resource transfer training data; and

and calculating Gaussian weighting based on the resource transfer test data to obtain an ant colony global optimal pheromone and a path solution, and updating the pheromone concentration and the ant colony position of the iterative ant colony state according to the individual pheromone so as to take the updated ant colony position as supervision information of model training.

8. The method of claim 1, further comprising:

carrying out normalization processing on the resource transfer training data to obtain normalized resource transfer training data; and

the input layer is specifically configured to transmit the normalized resource transfer training data to the hidden layer.

9. The method of claim 8, wherein the normalizing the resource transfer training data to obtain normalized resource transfer training data comprises:

and performing at least one of data redundancy cleaning, resource transfer missing value supplement and resource transfer relevance fusion on the historical resource transfer training data to obtain normalized resource transfer training data.

10. The method of claim 9, wherein the performing data redundancy flushing comprises:

performing wavelet transformation on resource transfer data from different sources to obtain wavelet coefficients;

performing threshold processing on the obtained wavelet coefficient by adopting an activation function; and

and performing inverse wavelet transformation on the wavelet coefficient subjected to threshold processing to obtain redundancy-removed resource transfer data.

11. The method of claim 9, wherein the resource transfer deficiency value supplementation comprises:

for the incomplete resource transfer samples, calculating the distance from the incomplete resource transfer samples to at least part of samples in the resource transfer sample set by taking the Euclidean distance as a standard to obtain k neighbors of the incomplete resource transfer samples;

setting a sampling ratio according to the sample unbalance ratio to determine a sampling multiplying power;

for each resource transfer sample, randomly selecting a sample from the k neighbors based on the sampling multiplier; and

12. The method of claim 9, wherein the resource transfer affinity fusing comprises:

selecting an information entropy value of a resource transfer sample, wherein the information entropy value is characterized based on uncertainty of resource transfer sample data and an information set of a residual resource transfer sample;

calculating the difference degree between the resource transfer sample data and the residual resource transfer sample information set based on the information entropy of the resource transfer sample; and

and calculating the relevance of at least part of the resource transfer data according to the uncertainty and the difference degree, and sequencing to obtain a fused resource transfer data set.

13. The method according to any one of claims 1 to 12, wherein the resource transfer anomaly detection model is constructed by training error accuracy using a gradient descent method.

14. The method of any one of claims 1 to 12, wherein:

the neural network comprises a radial basis neural network;

the activation function of the hidden layer is a Gaussian function; and

the network parameters of the hidden layer comprise a hidden layer basic function center, a basic function width, the number of hidden layer nodes and the connection weight of output nodes.

15. The method of any of claims 1-12, wherein the at least one specified dimension comprises: at least one of a common resource transfer mode, a resource transfer type, common resource transfer time, a resource transfer amount threshold, a previous resource transfer detection result, a resource transfer frequency and a common resource transfer address.

16. An abnormal behavior detection method, comprising:

acquiring a resource transfer request, wherein the resource transfer request comprises resource transfer data;

processing the resource transfer data by using the trained neural network to obtain a resource transfer abnormality detection model; and

processing the resource transfer data based on the resource transfer abnormity detection model and the user resource transfer behavior portrait to obtain a behavior type of the resource transfer data, and processing the resource transfer request based on the behavior type of the resource transfer data;

wherein the neural network comprises:

the hidden layer is used for mapping the resource transfer training data from a low-dimensional space to at least one specified dimension of a high-dimensional space to obtain an output result aiming at the at least one specified dimension;

the neural network is trained by:

17. An abnormal behavior detection apparatus comprising:

a request obtaining module, configured to obtain a resource transfer request, where the resource transfer request includes resource transfer data;

the data processing module is used for processing the resource transfer data by utilizing the trained neural network to obtain a resource transfer abnormity detection model; and

the behavior type determining module is used for processing the resource transfer data based on the resource transfer abnormity detection model and the user resource transfer behavior portrait to obtain the behavior type of the resource transfer data so as to process the resource transfer request based on the behavior type;

wherein the neural network comprises:

the neural network is trained by:

18. An abnormal behavior detection system comprising:

the resource transfer data acquisition module is used for acquiring current resource transfer data, historical resource transfer data, third-party payment information and credit investigation information so as to finish resource transfer data acquisition;

the resource transfer element fusion module is used for preprocessing the resource transfer data and fusing the resource transfer relevance to obtain a resource transfer data set;

and the resource transfer abnormity detection module is used for training a neural network by using the resource transfer data set to obtain a user resource transfer behavior portrait and a resource transfer abnormity detection model, processing the current resource transfer data by using the trained neural network, and determining the probability that the current resource transfer data belongs to an abnormal behavior based on a processing result, the user resource transfer behavior portrait and the resource transfer abnormity detection model so as to perform resource transfer control.

19. An electronic device, comprising:

one or more processors;

a storage device for storing executable instructions which, when executed by the processor, implement a method of training a neural network as claimed in any one of claims 1 to 15, or implement a method of abnormal behaviour detection as claimed in claim 16.